I'm getting sick - Problems filtering IPv6.

[Frank Steinborn]

Max Laier wrote:
> On Tuesday 01 August 2006 16:29, Frank Steinborn wrote:
> > That's it. It's not possible, and i'm really frustrated for days now.
> > What is actually borked here? Let's have a look on the pflog0, what's
> > dropping:
> >
> > 15:26:35.983709 rule 1/0(match): block in on gif0:
> > 2001:1638:17ad::3.53 > 2001:1638:17ad::3.59761:  tcp 40 [bad hdr
> > length 4 - too short, < 20]
> >
> > Hmm. Bad hdr lenght? What's up here? If i change the rule
> 
> This really just is an artefact from a too short snaplen.  Use -s 1500 and you 
> get rid of it.
> 
> The strange thing, however, is that this is the reply *from* port 53.  So this 
> means the initial SYN got through alright.  Can you check if a state has been 
> created (pfctl -vss) for that connection, please.  I suspect that it has and 
> the problem would be that the reply doesn't match the state - for what ever 
> reason.  Please check if there is a state and let me know - thanks.

Hello Max,

a state is created, yes:

self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810]
SYN_SENT:ESTABLISHED
   [342525613 + 65536](+2469478632) wscale 1  [3355548528 +
65537](+82545723) wscale 1
   [1845438366 + 4880](+1776883750)  [3423429433 + 65535](+3331864375)
   age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450
bytes
   age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453
bytes
   age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333
bytes


Strange thing :-(

Thanks,
Frank